EventLog.WriteEntry Limits:

  • Thread starter Thread starter A.M
  • Start date Start date
A

A.M

Hi,

I am using

EventLog.WriteEntry Method (String source, String message, EventLogEntryType
type)

methot to log a very long string (108402) as message to event log.

It gives me this exception:

Exception Type: System.ComponentModel.Win32Exception
NativeErrorCode: 87
ErrorCode: -2147467259
Message: The parameter is incorrect
TargetSite: Void WriteEvent(Int32, Int16,
System.Diagnostics.EventLogEntryType, System.String[], Byte[])
HelpLink: NULL
Source: System

If I change the [message] parameter to a shorter string, It works fine.

What is limitation for [message] parameter of EventLog.WriteEntry method ?

Thanks,
Alan
 
A.M said:
Hi,

I am using

EventLog.WriteEntry Method (String source, String message, EventLogEntryType
type)

methot to log a very long string (108402) as message to event log.

It gives me this exception:

Exception Type: System.ComponentModel.Win32Exception
NativeErrorCode: 87
ErrorCode: -2147467259
Message: The parameter is incorrect
TargetSite: Void WriteEvent(Int32, Int16,
System.Diagnostics.EventLogEntryType, System.String[], Byte[])
HelpLink: NULL
Source: System

If I change the [message] parameter to a shorter string, It works fine.

What is limitation for [message] parameter of EventLog.WriteEntry method ?
Click to expand...

I have estimated about 4k for the message parameter. For longer strings,
I've used the data parameter (though it requires your own reader to see the
data legibly).
 
Hi Alan,

The WriteEntry method will call the ReportEvent API underlying. As the
ReportEvent API documented in MSDN, the message will have a limitation of
32K.

lpStrings
[in] Pointer to a buffer containing an array of null-terminated strings
that are merged into the message before Event Viewer displays the string to
the user. This parameter must be a valid pointer (or NULL), even if
wNumStrings is zero. Each string has a limit of 32K characters.

For detailed information please refer to the link below.
ReportEvent
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/debug/base/
reportevent.asp

Best regards,

Peter Huang
Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security
This posting is provided "AS IS" with no warranties, and confers no rights.
 
A.M said:
Hi,

I am using

EventLog.WriteEntry Method (String source, String message,
EventLogEntryType type)

methot to log a very long string (108402) as message to event log.
Click to expand...

Umm, you are not using the event log correctly. Its not designed to be used
with huge messages. use the event log viewer and look at the properties for
the log and look at the size. How many 100K messages can you fit in the
event log? The event log is really designed to take an ID to a format string
(that has placeholders) and the strings that will be inserted into the
format string. The insert strings should be small to conserve resources.
Your immediate problem comes from the lazy way that the EventLog class has
been written, because the *entire* string (format and insert strings) are
put in the event log. Even if you use format strings instead you have
another problem, that is how is a huge message viewed in the event log
viewer. Why don't you do like Microsoft does, and provide a link to the huge
page? (ie store the big messages as HTML pages in a temporary store.)

Richard
 
Back
Top